configuring-oauth2-authorization-flow

OAuth2 authorization flows with PKCE for public clients are configured by enforcing S256 verification, exact redirect URI matching, and secure token rotation to prevent token interception. This skill provides concrete configuration guidance and validation scripts for these deployments.

Auditing OIDC deployments for token security involves discovering OIDC metadata, verifying endpoints, testing token issuance, and checking revocation capabilities. Automated scripts can run these checks against your issuer URL to produce human-readable security audit reports.

Yes, this approach supports Client Credentials and Device Authorization grants alongside Authorization Code with PKCE. It enforces token rotation, revocation, and scope design for least privilege across confidential clients and device clients.

Refresh token rotation prevents intercepted OAuth2 tokens from being misused by invalidating the old token upon each refresh request. This skill configures rotation, revocation, and DPoP sender-constrained tokens to eliminate common attack vectors.

Yes, you can validate JWKS and OIDC discovery metadata during deployment. The skill implements automated endpoint discovery and JWKS validation to verify issuer configurations and ensure token endpoints authenticate correctly.

Enforcing exact redirect URI matching in OAuth2 configurations prevents authorization code interception by malicious endpoints. This skill checks redirect URI policies to ensure misconfigured deployments do not expose authorization codes to interception.